Part One of Four
By Bretta Kelly
Editorial update: This 2026 edition preserves the practical themes, examples, and point of view of Bretta Kelly’s original “ISO 9000 Is Not Rocket Science” series while updating outdated ISO 9001:2000 references and terminology for ISO 9001:2026.
Introduction
Let me start by saying this: I still love ISO 9001.
When it is understood and implemented properly, ISO 9001 can be one of the best tools an organization has to improve its processes, reduce waste, strengthen customer satisfaction, and make better business decisions.
When it is misunderstood, however, it can become a paperwork exercise that frustrates employees, wastes time, and creates a system that nobody really wants to use.
That was true more than twenty years ago, and unfortunately it is still true today.
ISO 9001:2026 builds on the familiar ISO 9001 framework rather than replacing it. The 2026 edition places stronger emphasis on leadership, quality culture, ethical behavior, organizational knowledge, and a clearer distinction between risks and opportunities. Customer focus, the process approach, risk-based thinking, and continual improvement remain at the heart of the standard.
The standard has changed over the years, but the biggest mistake companies make has not changed very much at all: they make ISO more complicated than it needs to be.
ISO 9001 is not supposed to force your organization to operate according to somebody else’s idea of a perfect company. It should help you understand how your own organization works, determine what your customers and other relevant interested parties require, measure whether your processes are achieving the desired results, and improve where necessary.
That is not rocket science.
Unless, of course, your company builds rockets.
What is ISO 9001 really about?
ISO 9001 is a management system standard.
It is not simply a quality department standard, and it is certainly not a collection of forms that have to be completed so an auditor will be happy.
It applies to the way an organization manages its processes from beginning to end: understanding requirements, planning work, providing resources, controlling operations, monitoring results, addressing problems, and improving performance.
The current standard continues to use the process approach and the Plan-Do-Check-Act model as its foundation.
- Plan – Determine what needs to happen, what result is expected, what resources are required, and how success will be measured.
- Do – Carry out the process.
- Check – Monitor and measure what happened. Did the process achieve the result you planned?
- Act – If the result was not what you wanted, determine why. Correct the problem, address the cause where appropriate, and improve the process.
That is the heart of ISO 9001.
Every organization already has processes. Sales is a process. Purchasing is a process. Receiving is a process. Production is a process. Training is a process. Calibration is a process. Customer support is a process.
- Do you understand them?
- Do the people involved understand them?
- Are they producing the result you expect?
- How do you know?
- What happens when they do not?
- What opportunities exist to make them better?
If your management system cannot help you answer those questions, then I would question what value the system is providing.
The system belongs to the business
One of the most persistent myths surrounding ISO 9001 is that the system belongs to the Quality Manager.
It does not.
The Quality Manager may coordinate parts of the system. An internal auditor may help evaluate it. A consultant may help explain the requirements. A certification auditor may verify conformity. But the management system belongs to the organization.
ISO 9001 covers the whole business, from understanding customer requirements through delivering products or services and monitoring whether those requirements were achieved.
The 2026 edition gives even more attention to leadership, organizational quality culture, and ethical behavior. Quality cannot simply be delegated to one person or one department and forgotten. Top management has to create an environment in which people understand what quality means to the organization and how their work contributes to it.
If the only person who understands your ISO system is the Quality Manager, you do not have a strong management system. You have a dependency.
Myth: ISO requires a mountain of paperwork
No, it does not.
This is one of the myths that has done more damage to ISO 9001 than almost anything else.
Older versions of ISO 9001 had more explicit documentation requirements. Modern ISO 9001 takes a much more practical approach. The organization determines the documented information it needs for the effective operation of its quality management system and to provide confidence that processes are being carried out as planned.
That does not mean document everything. It means document what you need. There is a difference.
- If a simple checklist works, use a checklist.
- If a picture works, use a picture.
- If a short video works better than a written instruction, use the video.
- If training is the best control, train the person.
Do not build a documentation system simply because somebody once told you, “ISO requires it.” Ask them to show you the requirement.
Myth: ISO 9001 should change how we run our business
This one needs to be turned around.
Your business processes may need to change because the processes are ineffective, risky, wasteful, inconsistent, or no longer suitable. They should not change simply because somebody believes ISO wants them to look different.
A good ISO 9001 system should reflect the way the organization actually operates while helping management identify where those operations can be improved.
Consultants can be valuable, but the system they help build must match the organization’s culture, products, services, and actual way of working. When employees do not recognize the system as their own, participation drops and the system becomes increasingly difficult to maintain.
Does the system look like your company? Or does it look like a template somebody brought from another company?
Risks are not the same as opportunities
ISO 9001:2026 makes the distinction between risks and opportunities clearer. This is a useful change.
Companies sometimes treat risk and opportunity as if it is one subject, one spreadsheet, and one exercise performed once a year before the audit. That misses the point.
A risk is something that could interfere with the organization achieving the intended result. An opportunity is something that could help the organization achieve a better result. They are related, but they are not the same thing.
- A supplier with poor delivery performance may represent a risk.
- Developing a second qualified supplier may represent an opportunity.
- A process producing increasing scrap may represent a risk.
- Automating part of that process may represent an opportunity.
This is management thinking, not ISO paperwork.
What gets measured gets understood
ISO 9001 is not about collecting data just so you can make colorful graphs for management review. Data is useful only when it tells you something.
Organizations need to understand how to measure whether their processes are successful. Without that, management cannot easily identify which processes need attention.
For every important process, ask: What result are we trying to achieve? Then ask: How will we know whether we achieved it?
- For purchasing, perhaps you measure supplier delivery and quality.
- For production, perhaps you measure scrap, rework, output, downtime, or on-time completion.
- For customer support, perhaps you measure response time, resolution time, repeat issues, or customer feedback.
- For training, perhaps you measure competence rather than simply attendance.
- For corrective action, perhaps you measure recurrence.
The measurement should tell management whether the process is working. If it does not, why are you measuring it?
Do not confuse certification with the purpose of the system
Certification can be important. Customers may require it. Certain industries may expect it. It may open doors to new business.
But certification should not become the purpose of the management system. The certificate is evidence that the system has been independently assessed. The real value of ISO 9001 comes from what happens inside the organization every day.
- Are processes becoming more effective?
- Are recurring problems being eliminated?
- Are employees clearer about expectations?
- Are customer requirements being met?
- Are decisions being made using useful information?
- Are risks being controlled?
- Are opportunities being pursued?
- Is the organization improving?
If the answer to those questions is yes, the certification audit becomes much less frightening because the organization is simply demonstrating a system it already understands and uses.
The common-sense approach
Do not build an ISO system for the auditor. Build a management system for the business.
- Understand the requirements.
- Define your processes.
- Decide what information you need.
- Train your people.
- Measure what matters.
- Look at the results.
- Fix what is not working.
- Improve what can be better.
ISO 9001:2026 strengthens several areas, but it does not change that basic philosophy.
And that is why, after all these years, I still believe ISO 9001 is one of the most practical management tools available when organizations stop treating it like a paperwork requirement and start using it to run the business.
It is not rocket science.
Coming in Part Two: PLAN
In Part Two, we will look at one of the biggest sources of frustration in ISO systems: over-documentation.
We will challenge some long-standing myths about procedures, work instructions, forms, document control, and what ISO 9001:2026 actually expects organizations to document.
And yes, we are keeping the bow-tie story.
About the Author
Bretta Kelly is the owner and operator of Business Management Systems Consulting, LLC (BMSC). She has more than 30 years of experience implementing and managing business management systems across a wide range of manufacturing industries, including aerospace, electronics, and semiconductor environments.
Her experience includes implementation of business management systems for more than 200 manufacturing companies. Bretta holds Bachelor of Science and Master of Science degrees in Industrial Engineering from Arizona State University and holds quality and aerospace auditing credentials. She is also a CIS Certified Consultant and President of CIS World Wide Sales Group, LLC.
Learn more about Bretta Kelly and Business Management Systems Consulting: https://www.businessmsc.com/brettakelly